How can I stop users running apps that don't need admin rights?

Start by checking whether AppLocker is enforcing the rules you think it is. Make sure the Application Identity service is running, then look at the AppLocker logs in Event Viewer for the executables that got through.

Review the effective rules on an affected machine. In particular, look for broad allow rules covering user-writable locations such as Downloads, Desktop, Documents or AppData. An allowlist needs to permit approved software without also allowing users to run anything they put in those folders.

Focus on execution, not just installation. A standard user can put software in their own profile without an admin prompt, and some apps can run without a conventional installation at all. Blocking the Store doesn't cover those cases.

AppLocker default rules can provide a starting point for allowing Windows and Program Files locations, but review them against your environment before enforcing. Make sure ordinary users can't write to locations you've broadly allowed. Test with a small group and check the logs before a wider rollout so you don't accidentally block needed software.

You could also evaluate a third-party application control product if AppLocker is too difficult to manage for your setup. Look for default-deny execution controls and a practical way to approve legitimate apps. That still needs policy design and testing, not just an agent install.

Software restriction policies with path rules are another option for targeting executables in user profile locations. Blocking only Downloads is pretty narrow, though. Apps may run from other writable folders, so review the paths and test the impact on legitimate per-user software.